nx_ws_hygiene_core.nx
buildroot/runtime/nx_ws_hygiene_core.nx
about
nx_ws_hygiene_core.nx -- importable CORE of the WORKSTREAM HYGIENE classifier (R-ORCH janitorial
enforcement, 07-15 operator: "stop having silly things like shell and tsv and non-api bullshit
when workstreams are started"). Turns rule 27 (api-first-no-shell) + no-TSV + no-plumbing from
DOCTRINE into a MECHANICAL verdict: classify a workstream operation line as SOVEREIGN or a
specific VIOLATION. The ONE sanctioned shell use (launch a sovereign build/ship ELF -- rule 27)
is exempted BY NAME and short-circuits GREEN; everything else that reaches for shell/TSV/tmp-
redirect/raw-plumbing to do workstream work is flagged so it can be reworked onto the API/MCP
rails. Pure classifier here (gate-locked); a scanner/linter CLI wraps it. Read-only.
license_tier: ORIGINAL
dependencies 2 imports · 1 importers
imports: nx_syscalls.nxnx_crashresume_census_core.nx
imported by: nx_ws_hygiene_gate.nx
structs
| none |
consts
| 14 | const HV_NONE: i64 = 0 |
| 15 | const HV_SHELL_CHAIN: i64 = 1 // `sh -c` / `bash -c` glue |
| 16 | const HV_TMP_REDIRECT: i64 = 2 // `> /tmp/...` / `2>&1` (uncaptured, non-sovereign scratch) |
| 17 | const HV_TSV: i64 = 3 // .tsv output (should be seg_store) |
| 18 | const HV_WSL_PATH: i64 = 4 // /mnt/c path (MSYS-mangle-prone) used OUTSIDE the build lane |
| 19 | const HV_PLUMBING: i64 = 5 // scp/curl/tar/ssh/rsync (should be mgmt API) |
| 20 | const HV_SHELL_EXEC: i64 = 6 // running a non-build organ .elf via shell (should be tools/call) |
| 21 | const HV_SHELL_UTIL: i64 = 7 // raw shell PLUMBING as a workstream op: rm -f/-rf (the ACTUAL sin; lock-reaping -> nx_lock_reap) |
| 22 | const HV_TOKEN_BURN: i64 = 8 // Claude token-heavy one-off tool (WebFetch/WebSearch/Workflow/Agent/Task) |
| 23 | const HV_ACCEPTED_VCS: i64 = 9 // git add/commit/push = operator-ACCEPTED "git or beyond" VCS -- NOT a violation (sovereign-git = end-state; the sin was the ps|grep|rm plumbing AROUND git, not git) |
| 24 | const HV_SOV_BUILD: i64 = 10 // sanctioned build/ship lane (rule-27 exception) |
| 25 | const HV_SOV_API: i64 = 11 // mcp__nishi__ / /api/ / nx_mgmt / tools/call |
functions
| 28 | func hv_has(hay: *u8, hn: i64, needle: *u8) -> i64 |
| 44 | func hv_is_sanctioned_launcher(line: *u8, n: i64) -> i64 |
| 51 | func hv_is_sovereign_api(line: *u8, n: i64) -> i64 |
| 61 | func hv_classify(line: *u8, n: i64) -> i64 |
| 101 | func hv_tool_verdict(name: *u8, n: i64) -> i64 |
| 116 | func streq_hv(a: *u8, b: *u8) -> i64 called by 1: hv_tool_verdict |
| 123 | func hv_is_violation(v: i64) -> i64 |
| 128 | func hv_name(v: i64) -> *u8 |